RE: LSADump2 Crashing Systems

From: Ghetti, Tim (tghetti_at_air-worldwide.com)
Date: 09/09/05

  • Next message: pinoch0_at_gmail.com: "NAT is present?" 
    Date: Fri, 9 Sep 2005 16:17:25 -0400
To: "oh face" <0h.fac3@gmail.com>, <pen-test@securityfocus.com>, <focus-ms@securityfocus.com>

    I had this experience with a 2003 server domain controller fully
    patched. It killed the lsass process and force rebooted. At the time I
    was investigating an unrelated issue and thought that the reboot was due
    to the other issue. I never investigated this issue, as it was highly
    unlikely that anyone use the LSADump other than me.

    > -----Original Message-----
    > From: oh face [mailto:0h.fac3@gmail.com]
    > Sent: Friday, September 02, 2005 5:31 PM
    > To: pen-test@securityfocus.com; focus-ms@securityfocus.com
    > Subject: LSADump2 Crashing Systems
    >
    > In my recent pen-test experience, LSADump2 has been crashing
    > Windows boxes. I was able to verify this on fully patched
    > Windows XP and 2003.
    > In further examination, LSADump2, when executed, killed the "lsass"
    > process, and with the "winlogon" process still running, the
    > system was forced to reboot. As far as I know, LSADump2 is
    > utilizing a DLL injection technique to dump the contents of
    > LSA secrets.
    >
    > Question:
    > 1. Has anyone had this experience? If so, is there a safe
    > method to execute this tool?
    > 2. When I tested LSADump2 on various Windows boxes, not all
    > fully patched boxes were affected by this issue. What
    > configuration of Windows is exactly causing "lsass" to fail?
    >
    > Cheers.
    >
    > --------------------------------------------------------------
    > ----------------
    > Audit your website security with Acunetix Web Vulnerability Scanner:
    >
    > Hackers are concentrating their efforts on attacking
    > applications on your website. Up to 75% of cyber attacks are
    > launched on shopping carts, forms, login pages, dynamic
    > content etc. Firewalls, SSL and locked-down servers are
    > futile against web application hacking. Check your website
    > for vulnerabilities to SQL injection, Cross site scripting
    > and other web attacks before hackers do!
    > Download Trial at:
    >
    > http://www.securityfocus.com/sponsor/pen-test_050831
    > --------------------------------------------------------------
    > -----------------
    >
    >
    >

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: pinoch0_at_gmail.com: "NAT is present?"

    Relevant Pages

    • RE: New article on SecurityFocus
      ... the vector doesn't exploit vulnerabilities... ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ... login pages, dynamic content etc. Firewalls, SSL and locked-down servers ...
      (Pen-Test)
    • RE: Correlating an IP address with a phone number
      ... Most dial-in servers store the caller-ID info in the MIB. ... MIB and get both the IP address and phone number of a user. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • RE: Designing Network Security
      ... network design since we are the ones who actually test the stuff out there ... web servers since a large majority of the ones I've run across doing ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping ...
      (Pen-Test)
    • RE: superscan on win2k vs winxp
      ... >Audit your website security with Acunetix Web Vulnerability Scanner: ... >Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping carts, ... login pages, dynamic content etc. Firewalls, SSL and locked-down servers ...
      (Pen-Test)
    • RE: e-mail address mining tool?
      ... Note that some mail servers do not support this command in order to thwart ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Hackers are concentrating their efforts on attacking applications on your ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)